FortiManager Upgrade Guide VERSION

Transcription

1 FortiManager Upgrade Guide VERSION

2 FORTINET DOCUMENT LIBRARY FORTINET VIDEO LIBRARY FORTINET BLOG CUSTOMER SERVICE & SUPPORT FORTIGATE COOKBOOK FORTINET TRAINING SERVICES FORTIGUARD CENTER END USER LICENSE AGREEMENT FEEDBACK April 29, 2015 FortiManager Upgrade Guide

3 TABLE OF CONTENTS Change Log 4 Upgrade Overview 5 Best practices 5 Upgrading from previous versions 5 Upgrading from FortiManager version or later 5 Upgrading from FortiManager version or earlier 6 VM environments 6 Firmware upgrade steps 6 Upgrading the FortiManager firmware for an operating cluster 8 Appendix A: FortiManager Firmware 9 Firmware image naming convention 9 FortiManager VM firmware 9 SNMP MIB download 10 Build numbers 10 Firmware upgrade and support information 10 Downgrading to previous firmware versions 14

4 Change Log Date Change Description Initial release Updated the VM Partition and VM firmware Information in the Upgrade Information chapter. 4 Upgrade Guide

5 Upgrade Overview This section explains how to properly upgrade to FortiManager version Best practices Before any firmware upgrade complete the following: Download the FortiManager firmware image and Release Notes document from the Fortinet Customer Service & Support portal. Review the Release Notes including special notices, upgrade information, product integration and support, resolved and known issues. Prepare your FortiManager for upgrade. Install any pending configurations, ensure your managed devices are running the appropriate firmware versions as documented in the firmware Release Notes. Backup your configuration file. It is recommended that you create a system backup file and save this configuration to your local computer. The device configuration file is saved with a.dat extension. Plan a maintenance window to complete the firmware upgrade. If possible, you may want to set up a test environment to ensure that the upgrade does not negatively impact your network or managed devices. Once the upgrade is complete, test your FortiManager device to ensure that the upgrade was successful and that all managed devices are listed. Stay current on patch releases for your current major release. Only upgrade to a new major release or version when you are looking for specific functionality in the new major release or version. For more information, see the FortiManager Release Notes or contact Fortinet Technical Support. Upgrading the device firmware can trigger an SQL database rebuild. During this time, new logs will not be available until the rebuild is complete. The time required to rebuild the database is dependent on the size of the database. You can use the diagnose sql status rebuild-db command to display the SQL log database rebuild status. Upgrading from previous versions Upgrading from FortiManager version or later FortiManager version supports upgrading from version or later. FortiManager version or later has re-sized the flash partition storing system firmware. If your FortiManager is running 5.0.6, you will need to change the hard disk provisioned size to more than 512 MB in your VM environment before powering on the FortiManager VM. The secondary firmware and System Settings stored in the partition is lost after upgrade. Please reconfigure System Settings as needed. 5 Upgrade Guide

6 VM environments Upgrade Overview If your FMG-400B is running 5.0.6, it is required to use an interim step.you MUST upgrade to version before upgrading to version For more information see the FortiManager Release Notes. The upgrade path looks like this: or earlier > > > Upgrading from FortiManager version or earlier In order to accommodate the re-sizing of the flash partition, you MUST upgrade your device to version first. Please upgrade your FMG-5001A via the Web-based Manager or command line interface. Upgrade via TFTP from BIOS is not supported for this model. VM environments In VM environments, you will need to change the hard disk provisioned size to 513MB or more before powering on the FortiManager VM. It is recommended that you upgrade your VM server to the latest stable update and patch release offered by the VM host server provider. In VM environments, it is recommended that you clone the VM instance. In the event of an issue with the firmware upgrade, you can to revert to the VM clone. Firmware upgrade steps The following table lists the firmware upgrade steps. Step 1 Step 2 Step 3 Step 4 Prepare your device for an upgrade. Backup your device configuration. Transfer the firmware image to your device. Log into the Web-based Manager to verify the upgrade was successful. Step 1: Prepare your device for an upgrade 1. Install any pending configurations. 2. Make sure all managed devices are running the supported firmware versions as stated in the Firmware Release Notes. 3. Log in to the Fortinet Customer Service & Support portal at Upgrade Guide 6

7 Upgrade Overview Firmware upgrade steps 4. Select Download from the toolbar and select Firmware Images from the drop-down list. 5. Select FortiManager from the product drop-down list and select the Download tab. The image folders are displayed. 6. Browse to the appropriate file folder to download the firmware image (.out) and Release Notes document. 7. Select an image in the list to and click the HTTPS link to download the firmware image to your management computer. 8. To verify the integrity of the download, select the Checksum link next to the HTTPS download link. A dialog box will be displayed with the image file name and checksum code. Compare this checksum with the checksum of the firmware image. Step 2: Backup your device configuration 1. Go to System Settings > Dashboard. 2. Select Backup in the System Information widget. The Backup dialog box opens. 3. Select the checkbox to encrypt the backup file and enter a password. When selecting to encrypt the backup configuration file, the same password used to encrypt the file will be required to restore this backup file to your device. 4. Select OK and save the backup file on your local computer. Optionally, you can backup the configuration file to a FTP, SFTP, or SCP server using the following CLI command: execute backup all-settings {ftp sftp} <ip> <path/filename save to the server> <username on server> < password> <crptpasswd> execute backup all-settings scp <ip> <path/filename save to the server> <SSH certificate> <crptpasswd> For more information, see the FortiManager CLI Reference. Step 3: Transfer the firmware image to your device 1. Go to System Settings > Dashboard. 2. In the System Information widget, in the Firmware Version field, select Update. The Firmware Upgrade dialog box opens. 3. Select Browse to locate the firmware package (.out file) that you downloaded from the Customer Service & Support portal and select Open. 4. Select OK. Your FortiManager will upload the firmware image and you will receive a confirmation message noting that the upgrade was successful. Optionally, you can upgrade firmware stored on an FTP or TFTP server using the following CLI command: execute restore image {ftp tftp} <file path to server> <IP of server> <username on server> <password> For more information, see the FortiManager CLI Reference. 7 Upgrade Guide

8 Upgrading the FortiManager firmware for an operating cluster Upgrade Overview During the upgrade process the Web-based Manager might be temporarily unavailable until the device configuration database is successfully reconfigured. A progress bar is displayed in the Web-based Manager log in page. Step 4: Log into the Web-based Manager to verify the upgrade was successful 1. Refresh the browser and log back into the device. 2. Launch the Device Manager module and make sure that all formerly added devices are still listed. 3. Select each ADOM and make sure that managed devices reflect the appropriate connectivity state. Optionally, go to System Settings > All ADOMs. 4. Launch other functional modules and make sure they work properly. Upgrading the FortiManager firmware for an operating cluster You can upgrade the FortiManager firmware of an operating FortiManager cluster in the same was a upgrading the firmware of a standalone FortiManager unit. During the firmware upgrade procedure, you connect to the primary unit Web-based Manager or CLI to upgrade the firmware. Similar to upgrading the firmware of a standalone FortiManager unit, normal FortiManager operations are temporarily interrupted while the cluster firmware upgrades. As a result of this interruption, you should upgrade the firmware during a maintenance window. To upgrade FortiManager HA cluster: 1. Log into the primary unit Web-based Manager using the admin administrator account. 2. Upgrade the primary unit firmware. The upgrade is synchronized between the primary device and backup devices. Administrators may not be able to connect to the FortiManager Web-based Manager until the upgrade synchronization process is complete. During the upgrade, using SSH or telnet to connect to the CLI may also be slow, however use the console to connect to the CLI. Upgrade Guide 8

9 Appendix A: FortiManager Firmware This chapter provides an overview of FortiManager firmware and highlights general information you should be aware of prior to upgrading your FortiManager device. This is intended to supplement the FortiManager Release Notes documentation. Firmware image naming convention Firmware images in the Fortinet Customer Service & Support portal are organized by product, firmware version, major release, and patch release. The firmware images in the folders follow a specific naming convention and each firmware image is specific to the device model. For example, the FMG_300D-v500-build0345-FORTINET.out image found in the /FortiManager /v5.00/5.0/5.0.9/ file folder is specific to the FortiManager 300D device model. FortiManager VM firmware Fortinet provides FortiManager VM firmware images for Amazon AWS, Microsoft Hyper-V Server, and VMware ESX/ESXi virtualization environments. Amazon Web Services The 64-bits Amazon Machine Image (AMI) is available on the AWS marketplace. Citrix XenServer and Open Source XenServer.out: Download the 64-bits firmware image to upgrade your existing FortiManager VM installation..out.openxen.zip: Download the 64-bits package for a new FortiAnalyzer VM installation. This package contains the QCOW2 file for the Open Source Xen Server..out.CitrixXen.zip: Download the 64-bits package for a new FortiManager VM installation. This package contains the Citrix XenServer Virtual Appliance (XVA), Virtual Hard Disk (VHD), and OVF files. Linux KVM.out: Download the 64-bits firmware image to upgrade your existing FortiManager VM installation..out.kvm.zip: Download the 64-bits package for a new FortiManager VM installation. This package contains QCOW2 that can be used by qemu. Microsoft Hyper-V Server.out: Download the firmware image to upgrade your existing FortiManager VM installation..hyperv.zip: Download the package for a new FortiManager VM installation. This package contains a Virtual Hard Disk (VHD) file for Microsoft Hyper-V Server. 9 Upgrade Guide

10 SNMP MIB download Appendix A: FortiManager Firmware VMware ESX/ESXi.out: Download either the 32-bit or 64-bit firmware image to upgrade your existing VM installation..ovf.zip: Download either the 32-bit or 64-bit package for a new VM installation. This package contains an Open Virtualization Format (OVF) file for VMware and two Virtual Machine Disk Format (VMDK) files used by the OVF file during deployment. For more information see the FortiManager product data sheet available on the Fortinet web site, VM installation guides are available in the Fortinet Document Library. SNMP MIB download You can download the FORTINET-FORTIMANAGER-FORTIANALYZER.mib MIB file in the firmware image file folder. The Fortinet Core MIB file is located in the main FortiManager v5.00 file folder. Build numbers FortiManager firmware images are generally documented as a three-digit build number. New FortiManager models may be released on a branch based off of the regular FortiManager firmware release. As such, the build number found in the System Settings > General > Dashboard, System Information widget and the output from the get system status CLI command displays this four-digit build number as the build number. To confirm that you are running the proper build, the output from the get system status CLI command has a Branch point: field that displays the regular three-digit build number. Firmware upgrade and support information The following table is for reference only. Review the applicable releases notes prior to upgrading your device. Upgrade and support information Firmware Version Build Number Upgrade From FortiOS Version Support or later to to Upgrade Guide 10

11 Appendix A: FortiManager Firmware Firmware upgrade and support information Firmware Version Build Number Upgrade From FortiOS Version Support Supported models: FMG-100C, FMG-200D, FMG-300D, FMG-400B, FMG-400C, FMG-1000C, FMG-1000D, FMG-3000B, FMG-3000C, FMG-4000D, FMG-4000E, FMG-5001A, FMG-VM32, FMG-VM64, and FMG-VM64-HV to and to Supported models: FMG-100C, FMG-200D, FMG-300D, FMG-400B, FMG-400C, FMG-1000C, FMG-1000D, FMG-3000B, FMG-3000C, FMG-4000D, FMG-4000E, FMG-5001A, FMG-VM32, FMG-VM64, FMG-VM64-AWS, and FMG-VM64-HV. FMG-VM64-AWS is released on build and to Supported models: FMG-100C, FMG-200D, FMG-300D, FMG-400B, FMG-400C, FMG-1000C, FMG-1000D, FMG-3000B, FMG-3000C, FMG-4000D, FMG-4000E, FMG-5001A, FMG-VM32, FMG-VM64, and FMG-VM64-HV and to Supported models: FMG-100C, FMG-200D, FMG-300D, FMG-400B, FMG-400C, FMG-1000C, FMG-1000D, FMG-3000B, FMG-3000C, FMG-4000D, FMG-4000E, FMG-5001A, FMG-VM32, FMG-VM64, and FMG-VM64-HV to or later to Supported models: FMG-100C, FMG-200D, FMG-300D, FMG-400B, FMG-400C, FMG-1000C, FMG-1000D, FMG-3000B, FMG-3000C, FMG-4000D, FMG-5001A, FMG-VM32, FMG-VM64, and FMG-VM64-HV. FMG-4000E is released on build to or later and Supported models: FMG-100C, FMG-200D, FMG-300D, FMG-400B, FMG-400C, FMG-1000C, FMG-1000D, FMG-3000B, FMG-3000C, FMG-4000D, FMG-5001A, FMG-VM32, FMG-VM64, and FMG-VM64-HV or later or later Upgrade Guide

12 Firmware upgrade and support information Appendix A: FortiManager Firmware Firmware Version Build Number Upgrade From FortiOS Version Support Supported models: FMG-100C, FMG-200D, FMG-300D, FMG-400B, FMG-400C, FMG-1000C, FMG-3000B, FMG- 3000C, FMG-4000D, FMG-5001A, FMG-VM32, FMG-VM64, and FMG-VM64-HV or later or later Supported models: FMG-100C, FMG-200D, FMG-300D, FMG-400B, FMG-400C, FMG-1000C, FMG-3000B, FMG- 3000C, FMG-4000D, FMG-5001A, FMG-VM32, FMG-VM64, and FMG-VM64-HV. FMG-VM64-HV is released on build FMG-1000D is released on build or or later Supported models: FMG-100C, FMG-200D, FMG-300D, FMG-400B, FMG-400C, FMG-1000C, FMG-3000B, FMG- 3000C, FMG-5001A, FMG-VM32, and FMG-VM64. FMG-300D is released on build FMG-4000D is released on build or later Supported models: FMG-100C, FMG-200D, FMG-400B, FMG-400C, FMG-1000C, FMG-3000B, FMG-3000C, FMG-5001A, FMG-VM32, and FMG-VM64. FMG-300D is released on build or later Supported models: FMG-100C, FMG-200D, FMG-400B, FMG-400C, FMG-1000C, FMG-3000B, FMG-3000C, FMG-5001A, FMG-VM32, and FMG-VM or later and later Supported models: FMG-100, FMG-100C, FMG-200D, FMG-400A, FMG-400B, FMG-400C, FMG-1000C, FMG- 3000, FMG-3000B, FMG-3000C, FMG-5001A, FMG-VM32, and FMG-VM or later and later Supported models: FMG-100, FMG-100C, FMG-200D, FMG-400A, FMG-400B, FMG-400C, FMG-1000C, FMG- 3000, FMG-3000B, FMG-3000C, FMG-5001A, FMG-VM32, and FMG-VM64. Upgrade Guide 12

13 Appendix A: FortiManager Firmware Firmware upgrade and support information Firmware Version Build Number Upgrade From FortiOS Version Support or later to Supported models: FMG-100, FMG-100C, FMG-200D, FMG-400A, FMG-400B, FMG-400C, FMG-1000C, FMG- 3000, FMG-3000B, FMG-3000C, FMG-5001A, FMG-VM32, and FMG-VM or later to Supported models: FMG-100, FMG-100C, FMG-400A, FMG-400B, FMG-400C, FMG-1000C, FMG-3000, FMG- 3000B, FMG-3000C, FMG-5001A, FMG-VM32, and FMG-VM64. Note: There is no image available for the FMG-200D or later to Supported models: FMG-100, FMG-100C, FMG-200D, FMG-400A, FMG-400B, FMG-400C, FMG-1000C, FMG- 3000, FMG-3000B, FMG-3000C, FMG-5001A, FMG-VM32, and FMG-VM or later and Supported models: FMG-100, FMG-100C, FMG-400A, FMG-400B, FMG-400C, FMG-1000C, FMG-3000, FMG- 3000B, FMG-3000C, FMG-5001A, FMG-VM32, and FMG-VM or later Supported models: FMG-100, FMG-100C, FMG-400A, FMG-400B, FMG-1000C, FMG-3000, FMG-3000B, FMG- 3000C, FMG-5001A, FMG-VM32, and FMG-VM and Supported models: FMG-100, FMG-100C, FMG-400A, FMG-400B, FMG-1000C, FMG-3000, FMG-3000B, FMG- 3000C, FMG-5001A, and FMG-VM32. FMG-VM32 is released on build or later Supported models: FMG-100, FMG-100C, FMG-400A, FMG-400B, FMG-1000C, FMG-3000, FMG-3000B, FMG- 3000C, and FMG-5001A. 13 Upgrade Guide

14 Downgrading to previous firmware versions Appendix A: FortiManager Firmware In version 5.0, FortiClient endpoint agent configuration and management are now handled by the FortiGate Endpoint Control feature. You can configure your FortiGate device to discover new devices on your network, enforce FortiClient registration, and deploy a pre-configured endpoint profile to connected devices. This feature requires a FortiGate device running FortiOS version or later. For more information, see the Device and Client Reputation for FortiOS 5.0 Handbook available in the Fortinet Document Library. FortiManager version introduced a new hard disk drive partition layout which is required for optimal usage and performance. Following an upgrade to FortiManager version or later, a backup must be made and then the disk must be reformatted with following command: execute format {disk disk-ext4} A format will erase all local logs, and FortiGuard database information. Backup any local event logs that you wish to keep. The FortiManager will then need to re-download all of the AV/IPS/AS/WF objects from the FortiGuard Distribution Servers (FDS) which may take up to half a day. During that time managed devices will not be able to obtain these services from the FortiManager. You should configure devices to point to a backup FortiManager or the FDS for these services When upgrading from FortiManager version 4.2 EMS mode, you must run the Import Wizard for each managed device to ensure all rules and policies are added to the FortiManager. Downgrading to previous firmware versions FortiManager does not provide a full downgrade path. You can downgrade to a previous FortiManager firmware release via the Web-based Manager or CLI, but doing so results in configuration loss. A system reset is required after the firmware downgrading process has completed. To reset the system, use the following CLI commands via a console port connection: execute reset all-settings execute format {disk disk-ext4} Upgrade Guide 14

15 Copyright 2015 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, FortiCare and FortiGuard, and certain other marks are registered trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features, or development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations,and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.